How we protect your data
PartnerDock handles revenue data, partner records, and third-party integration credentials, so correct data isolation and credential security are core to the product, not an afterthought. Here is how we protect it, and where we are honest about the roadmap.
Encryption
All traffic is served over HTTPS/TLS. Sensitive third-party credentials, such as Shopify Partner API tokens and Google BigQuery service-account credentials, are encrypted with AES-256 (AES-GCM authenticated encryption) before they are stored, each with a unique random initialization vector. Decryption happens only server-side at the moment a credential is needed, and plaintext credentials are never returned to the browser. Our encryption scheme supports versioned keys and key rotation.
Tenant isolation
Every organization's data is isolated at the database layer with Postgres Row-Level Security, so one customer cannot read or modify another customer's affiliates, referrals, commissions, payouts, or revenue data. Public pages are served through tightly scoped views that expose only the specific non-sensitive fields they need. Privileged server operations always resolve the caller's own organization from their authenticated identity and constrain reads and writes to it, with particular care for users who are both a founder and an affiliate.
Access control and least privilege
Authentication is handled by Supabase Auth, and endpoints that handle private data require a valid, verified session. Administrative functions are restricted to internal administrators by explicit role checks. Sensitive secrets such as per-app tracking tokens are not readable by other roles. Account security features include self-service email change protected by a step-up verification and a time-limited revert window, and anti-enumeration behavior on password-reset and sign-in flows.
Webhook and integration verification
Inbound webhooks are authenticated before any payload is trusted. Billing webhooks use cryptographic signature verification with a timestamp tolerance to prevent replay, and scheduled-job and content webhooks are authenticated with secret tokens compared in constant time. Our install-attribution endpoint supports cryptographically signed requests with replay protection and secret-token rotation, so attribution events cannot be forged by a third party.
Secure development and testing
Server input is validated with schema validation, privileged database access follows least-privilege patterns with explicit ownership checks, and public endpoints that send email or provision accounts are protected by durable rate limiting. We perform periodic internal security reviews and penetration testing of our own application, covering tenant isolation, authorization, credential handling, injection and cross-site-scripting surfaces, webhook authentication, and account-recovery flows, and remediate findings on a prioritized basis.
Certifications
PartnerDock does not currently hold SOC 2 or ISO 27001 certification. These are on our roadmap and we are building our controls with them in mind. A written summary of our most recent internal security review is available to customers under NDA on request.
Reporting a vulnerability
If you believe you have found a security issue, we want to hear from you. Please email security@getpartnerdock.com with the details. We will acknowledge your report and keep you updated as we investigate. Please give us a reasonable chance to remediate before any public disclosure.